Performability Analysis of Multi-Layer
Restoration in a Satellite Network
K.N. Oikonomou, K.K. Ramakrishnan, R.D. Doverspike,
A. Chiu, M. Martinez-Heath1, R.K. Sinha
AT&T Labs Research, 1AT&T Labs
Abstract. The ability of an IP backbone network to deliver robust and dependable communications relies on quickly restoring service afte failures. Service-level agreements (SLAs)betweena network service provider and customers typically include overall availability andperformance objectives. To achieve the desired SLA, we have developed a methodology for the combined analysisofperformance and reliability(performability)
of networks across multiple layers by modeling the probabilistic failure state space in detail and analyzing different restoraion alternatives. This methodology has been used to analyze large commercial IP-over-Optical layer networks. In this paper we extend our methodology to evaluate restoration approaches for an IP-based satellite backbone network. Becauseoftheenvironmentinwhichtheyoperate(longdelaylinks,frequent impairments), satellite networks pose an interesting challenge to typical restoration strategies. We describe the potential multi-layer restoration alternatives and compare their performability. Interestingly, while it is commonly thought that SONET ring restoration at the lower layer improves overall reliability, we find that it may not always improve per-
formability in this environment.
1 Introduction
The ability of an IP backbone network to deliver robust and dependable communications relies on restoring service quickly afterfailures. Service-level agreements (SLAs) between a network service provider and customers typically includeoverallavailabilityandperformanceobjectives. Backbone networks are implementedinmultiplelayersand include complexinteractionsbetween switches or routers and protocols at ech layer. Usually, requirements are specified for each layer independently, without considering that end-to-end availability and performance depend on how the overall, multi-layer system functions as a whole,
and therefore the layers are not really separable. It is thus critical to understand how the layers interact, and to consider restoration from failures as a fundamental component of the network architecture.
In a layered telecommunications model, each layer can be thought of abstractly as a graph consisting of nodes (switching or routing points) and links (fixed transmission signals between the nodes). The links of one layer are carriedas connections atalowerlayer.Agivenlayerexperiences congestionand
2
loss from failures that originate at that layer or at lower layers. An important characteristic of layered networks is that failures that originate at a lower layer canbe restoredata higherlayerbutnot vice-versa.
It is important to have a methodology that can model and evluate the impactof failuresonperformanceand reliability,and assessthebenefitsofvarious restoration mechanisms. For this purpose we have developed nperf, a network performability analyzer.Performabilityanalysis (see, e.g. [Co] and §3) examines boththe reliability/availabilityandperformanceofa network,giventhetopology, restoration scheme, component failure probabilities, and traffic (demand).
The analysisevaluatesasetofperformance measures underallpossible failures,
including multiple simultaneous failures.
nperf hasbeen used extensively to study terrestrial metropolitan and long-
distance IP-over-optical layer networks. Such networks typically consist of an IP layer over a SONET or SDH layer. The SONET/SDH layer routes over a Wavelength Division Multiplexed (WDM) layer, which in turn routes over a fiber layer, although sometimes the SONET/SDH layer routes directly over the fiberlayer.Wehave explored the most efficientrestoration architectures for such terrestrial, commercial multi-layered networks in [Dov], [CS], [Phi], and [Li]. A further development is theperformability analysis in [OSD] and [OS06a].
Satellite networks pose a challenge with respect to restoration and restoration strategiesbecause of their long latencies. In addition, inter-satellite links are proneto frequentimpairmentsbecauseoftheenvironmentinwhichtheyoperate. With newer technologies such asFree Space Optics yielding high-capacity links (see [Chan]), the capacity of the satellite backbone can be quite significant, and failures mayaffect substantial amountsof traffic.Thus,performability analysis of satellite networks is important for understanding the effects of the various possible restoration aproaches. In this paper, we further extend our nperf methodologyto analyzeperformabilityofa 3-layer satellite network.
In §2 we present the satellite network and discuss how to achieve a balance between feasibilityand accuracy in modelling the restortion. In§3we describe the 4-levelperformability formalism usedby nperf and show how restoration at two layers can be accommodated within it. In §4 we present our results for three restoration alternatives for the satellite network. Some of the results are surprising. Finally, §5 gives our conclusions.
2 Satellite network, restoration schemes, and protocols
The network we study consists of five satellites in high stationary orbit
¼
30,000km above the earth, each connected to two ground stations. (This is an example network, and does not represent any specific architecture or traffic pattern of any commercial or government network.) Our network consists of 3 layers: an IP layer, a SONET layer, and a transport technology layer1 .
1
Both the actual network and its performability model consist of a number of levels.
We use the term “layer” in connection with the network, and the term “level” in connection with the model.
3
Thetoplayer consistsofIP routersandPacket-over-SONET(POS) linksbetween them in the form of concatenated STS-nc signals. Below this is a SONET cross-connect layer, whose nodes are stand-alone SONET add/drop multiplexers (ADMs), or ADM interfaces integrated into digital cross-connect systems,
connected by SONET OC-n links. The links of the IP-layer form connections (demand) that are routedover the SONETlayer. Thebottomlayer consistsof hard-configured technology (i.e., the nodes are not switches) to transport the SONET OC-n links; for example Free Space Optics (FSO) or RF technology (with appropriate interfacing and encapsulation of optical SONET signals). In addition, thebottom layer includes ground-to-space links to the satellites. Since thebottom layer is fixed, restoration (rerouting) takes place only in the toptwo layers, so most of our analysis addresses those layers. Consequently, the details of the technologies of thebottom layer and uplinks are not critical to our analysis.
We model and compare three differentnetwork restoration architectures. The firstuses BidirectionalLineSwitchedRing(BLSR)attheSONETlayer,atypical architecture in SONET terrestrial carrier networks. The second relies on IP-layer rerouting alone based on OSPF (see [Moy]), typical of long-distance carrier IP networks. Finally, the third uses SONET BLSR restoration, supplemented by IP-layer restoration whenever needed.
2.1 Protocols
Both SONET BLSR and IP OSPF restoration rely on complex protocols to detect a failure and notify the network nodes to take apprpriate action. Because performabilityanalysis requires the evaluationof theperformance measuresover a very large number of network states (see §3.1), it is impractical to incorporate the detailsof these protocolsinto the analysis.For this reasonwe abstract manyof these details, while ensuring that we model the effect of the restoration mechanism on theperformance measures to acceptable accuracy. The most important parameters are thedurations ofthe restorations,which we assumetobe constants (upperbounds), denoted ¿son and ¿ospf for the SONET and IP layers respectively.
Because of the long distancesbetween the satellites, ¿son in our topology can be substantially longer than the 50 ms, which is typical in terrestrial SONET networks. We also assume that the SONET restoration is revertive, so there is one interval of duration ¿son during restoration and one upon completion of the repair2 .
For IP-only restoration all nodes in our topology are within the same OSPF area, so the predominanttime is for OSPF to detect and recover from the failure (converge). Whereas the failure detection time is relatively immune to topology [MGR], the convergence time depends on several timers which have to be set conservativelybecause ofthe lengthofthe links.The default valueforthe
2
The 2nd interval may be eliminated with a technique known as “bridge and roll”,
but we do not consider this here.
OSPF Hello timer is 10 seconds, which we assume is retained in this environment. The RouterDeadInterval (the number of Hello timer intervals that pass before an adjacency is declared broken) is4 Hello intervals. Thus, overall, the OSPF convergence time ¿ospf canbe several tens of seconds.
For the case of IP plus SONET restoration, we model the individual restorations as described above. However, standard BLSR implementations in terrestrial networks use only half the bandwidth under no-failure conditions, whichis unacceptable in the satellite environment where bandwidth is limited.We have adapted the BLSR implementation to the space environment where we allow IP to use the full capacity of the ring under n-failure conditions. Half of each IP link’s capacity is assigned to service slots (restorable) and the other half is assigned to restoration (pre-emptable) slots. Higher priority traffic (services that have associated guarantees) is routed over the service slots, with admission control to ensure that the total traffic does not exceed 50% of the link capacity. Although we model the above scenario appropriately, we do not model the distinct classes or the admission control function in nperf.
3 The performability model
We describe themulti-level model usedby nperf to represent a wide variety of networks with restorationata singlelayer,andhow thismodel can accommodate a network with restoration attwo layers. The nperf performabilitymodel has a demand level, a graph level, a component level, and a reliability level.
3.1 The 4-level model
The graph level represents the network’s “transport” layer. The network routing and restoration algorithms operate at this level, so graph edges have associated capacities and (routing) costs. The edges are directed, and there may be more than oneedgebetweenapairofnodes.The demandor trafficlevelspecifiesthe amount(andpossiblytype)of trafficflowingbetween pairsof graphnodesvia the edges.
At the component level, eachcomponent corresponds to anindependent failure mechanism (ensuring this requires some care in modelling); failure of a componentmayaffecta whole setof graph-level elements.Acomponent mayrepresent an actual network element, or maybeofa more abstract nature, and may have an arbitrary number of failure modes. In general, the effect of a component entering one of its failure modes is to change some of the attributes ofa setof graph nodes and edge.
Finally, the reliabilitylevel specifies the failure modes of the componentsby their mean time between failures (MTBF) and mean time to repair (MTTR).
Itis assumed that each componentisa continuous-time Markov process witha working (good) state G, and m = 1 failure (bad) states B1,...,Bm; the only transitions allowed arebetween G and the Bi. nperf assumes that the components are independent, and that they operate in their steady state.
If we have n components with m1,...,mn modes respectively, they define a state space S of size m1m2 mn (2n if all components are binary). This is
···
the space of all possible network states. Each state s . S has a (steady-state)
probabilityPr(s)foundbymultiplying together an appropriate setof component mode probabilities. If F isaperformance measure (function) that maps each network state to a real number, nperf evaluates the expectation of F over S, i.e.
F ¯= . F(s)Pr(s). (3.1)
s2S
Because finding F ¯ exactly is computationally hard ([Co], [Sh]), nperf produces lower and upper algebraicbounds to itsvalue; see §3.4. With our assumption that components fail independently, the underlying global Markov process is ergodic,
so F ¯ canbe interpreted as the long-run time average of F.
We emphasize that what is “visible” to the measure is the graph and demand level of the model. Even though at the component level eventsoccur independently, this is not so at the (higher) graph and demand levels. E.g., a mode change of a component may affect a whole set of graph-level elements at the same time.
The measures we use are Flnr(s), the amountof traffic that, after restoration,
is lostbecause it has no route in state s, and Flcg(s), the amount of traffic that is lost in s becauseof congestion on the links. Sinceaperformance measure has tobeevaluatedona largenumberof states, some approximationsto computing its value on a given state are usually necessary to render the overall computation feasible. In particular, for the Flcg measure we ignore the fact that TCP “throttles” a link when congestion is detected, and instead compute what would be more precisely called “lossin total network bandwidth”bysolvinga network flow problem in which the link capacities are set to a fraction of their nominal values; this fraction correspondstoa link utilization thresholdbeyond which we assume that routersbegin to drop packets.
3.2 The model with restoration at a single layer
The demand and graph levels Fig. 3.1 shows the graph and traffic levels of our model. The graph depicts the logical connectivity at the IP layer (see
§2). Each node ri is a satellite, and giA,giB are its ground stations. The edges between satellites have capacity5Gbps, whereas the up/down links are 10Gbps,
except those for r1, which are 12Gbps. All demands arebetween pairs of ground stations. There are “local” demands that go between the ground stations of a given satellite, and “long” demands whose ground stations belong to different satellites.For the symmetric traffic pattern all local demands are 2Gbps, and all long demands are 1.6Gbps. For the asymmetric pattern the local demands are again 2Gbps, and the long demands are 1Gbps, except for the4demands to g1A and the4 to g1B, which are 2Gbps.
r1r2r3r4r5g1Ag1Bg2Ag2Bg3Ag3Bg4Ag4Bg5Ag5B
0 = u = 0.25 0.25